Restrict access to specific menus (invoices only) in a module

Support System Administrator
1

I want to create a restricted role for a specific employee. They should:

​Only see Financial > Invoices in the menu (hiding Payments, Entries, Statements, etc.).

​Be able to Post an invoice, but NOT Pay it.

How can I achieve it?